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BACKGROUND:
The Postal Accountability and                We conducted these reviews in support
Enhancement Act of 2006 requires the         of an independent public accounting
U.S. Postal Service to comply with           firm’s reliance on management’s testing
Section 404 of the Sarbanes-Oxley Act        and overall audit opinions on the Postal
and report on the effectiveness of the       Service’s financial statements and
agency’s key internal controls over          internal controls over financial reporting.
financial reporting. The Financial
Testing Compliance group tests these         WHAT THE OIG FOUND:
key financial controls at postal units.      We observed the Financial Testing
                                             Compliance group’s tests at 99 sampled
This report addresses key financial          units. We determined that analysts
control testing related to business mail     properly tested, documented, and
entry units and detached mail units,         reported their examination of 237 key
where Postal Service employees verify        Sarbanes-Oxley financial reporting
the eligibility of the mail and charge the   controls.
mailer’s account with the correct
postage; plant verified drop shipments       WHAT THE OIG RECOMMENDED:
transported by the mailer from its plant     We did not identify any exceptions;
to destination Postal Service facilities;    therefore, this report does not contain
and business reply mail services that        recommendations. We communicated
provide customers with a convenient          our observations to the independent
prepaid method for replying to a mailing.    public accounting firm and Postal
                                             Service management throughout the
The overall objective of our review was      year. The firm used the information to
to evaluate whether the Financial            support its opinion on the fiscal year
Testing Compliance group properly            2013 Postal Service financial
tested, documented, and reported its         statements and controls over reporting.
examination of key Sarbanes-Oxley
financial reporting controls.                Link to review the entire report
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MEMORANDUM FOR:            TIMOTHY F. O’REILLY
                           VICE PRESIDENT, CONTROLLER




FROM:                      John E. Cihota
                           Deputy Assistant Inspector General
                            for Financial and Systems Accountability

SUBJECT:                   Management Advisory Report – Fiscal Year 2013 Financial
                           Testing Compliance Oversight Reviews
                           (Report Number FT-MA-14-005)

This report presents the overall results of our Fiscal Year 2013 Financial Testing
Compliance Oversight Reviews for business mail entry units, staged and continuous
detached mail units, plant verified drop shipments, and business reply mail (Project
Number 13WD001FI000).

We appreciate the cooperation and courtesies provided by your staff. If you have any
questions or need additional information, please contact Denice M. Millett, director,
Finance, or me at 703-248-2100.

Attachment

cc: Julie S. Moore
    Corporate Audit and Response Management
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Introduction

This report presents the overall results of our Fiscal Year (FY) 2013 Financial Testing
Compliance (FTC) Oversight Reviews for business mail entry units (BMEUs) and
detached mail units operating in a staged environment (staged DMUs), detached mail
units operating in a continuous environment (continuous DMUs), plant verified drop
shipments (PVDS), and business reply mail (BRM) (Project Number 13WD001FI000).
We conduct these oversight reviews to support the independent public accounting firm’s
(IPA) reliance on U.S. Postal Service management’s testing of Sarbanes-Oxley Act
(SOX) key financial controls and to increase focus on the remediation of control failures
in the field. Our overall objective was to evaluate whether the FTC group properly
tested, documented, and reported its examination of key SOX financial reporting
controls. See Appendix A for additional information about this review.

The Postal Accountability and Enhancement Act of 2006 (Postal Act of 2006) requires
the Postal Service to comply with Section 404 of SOX and report on the effectiveness of
key Postal Service internal controls over financial reporting. The Postal Service Board of
Governors contracted with the IPA to express an opinion about these controls. FTC
testers perform operational effectiveness testing on key internal controls in the field and
communicate the results to stakeholders. The oversight reviews cover controls at:

   BMEUs – units that process bulk business mail.

   DMUs – Postal Service work areas or offices located at a business mailer's facility.
    Their key controls are categorized as either staged or continuous.

    o Staged DMUs – postage statements are presented at the time of mail
      acceptance and verification in a staged environment.

    o Continuous DMUs – mailers present final postage statements after mail
      acceptance and verification.

   PVDS – a procedure that transports verified mail to the destination mail processing
    facility where mail processing employees verify the mail to supporting
    documentation.

   BRM – a service that allows a mailer to receive mail back from customers and pay
    postage only for returned pieces.
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Conclusion

We observed the FTC group conduct 237 internal control tests at 99 1 randomly selected
units. We determined the group properly tested, documented, and reported its
examination of the 237 key SOX financial reporting controls at all 99 units.

During the review, the FTC group noted 16 exceptions and we agreed with its results.
Specifically, for Postal Service quarters (Q) 2 1 through 4, FY 2013, we observed the
FTC group conduct tests for:

   Ninety-seven controls at 24 BMEUs/staged DMUs.
   Ninety-nine controls at 34 continuous DMUs.
   Sixteen controls at 16 BRM units.
   Twenty-five controls at 25 PVDS locations.

We communicated our oversight results to management via weekly discussions and
quarterly interim reports. We also communicated our results to the IPA via weekly
discussions and quarterly capping spreadsheets. We did not identify any exceptions;
beyond the 16 identified by the FTC group; therefore, this report does not contain
recommendations.




1
 The FTC group conducted testing at a total of 640 units in FY 2013.
2
 An accounting division of the fiscal year that consists of 4 monthly accounting periods that are based on calendar
months: Postal Service Q1 – October 1 through December 31; Postal Service Q2 – January 1 through March 31;
Postal Service Q3 – April 1 through June 30; and Postal Service Q4 – July 1 through September 30.
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                             Appendix A: Additional Information

Background

The Postal Act of 2006 requires the Postal Service to comply with Section 404 of SOX.
To do so, the Postal Service must report on the effectiveness of its internal controls over
financial reporting in an annual assessment to the Postal Regulatory Commission.

This report addresses key financial control testing of BRM at Postal Service units,
BMEUs and DMUs operating in a staged environment, mail verification and acceptance
at DMUs operating in a continuous environment, and PVDS procedures at Postal
Service mail processing facilities.

   BMEUs process bulk business mail. DMUs are Postal Service work areas or offices
    located at a business mailer's facility. DMU key controls are characterized as either
    staged or continuous. In a staged environment, postage statements are presented at
    the time of mail acceptance and verification but in a continuous environment, final
    postage statements are presented after mail acceptance and verification.

   BRM is a domestic service that allows mailers to receive First-Class® mailpieces
    back from customers and pay postage only for the returned pieces. These pieces
    must have a specific address and format and postage and fees are collected when
    the mail is delivered to the original mailer.

   PVDS is a procedure that enables origin verification and postage payment for
    shipments transported by the mailer from its plant to destination postal facilities for
    acceptance as mail. PVDS is typically used for mailings claiming a destination entry
    discount or price.

Objective, Scope, and Methodology

The overall objective of our review was to evaluate whether the FTC group properly
tested, documented, and reported its examination of key SOX financial reporting
controls. We conducted these oversight reviews in support of the IPA’s reliance on
management’s testing and overall audit opinion on the Postal Service’s financial
statements and internal controls over financial reporting.

To accomplish our objective, we observed the FTC group conduct key financial control
tests at 99 randomly selected units for BMEU/staged DMU and continuous DMU,
PVDS, and BRM. In addition, we determined whether the FTC group provided
supporting documentation for its work. We issued interim quarterly reports directly to
Postal Service management to communicate the results of our reviews. See Table 1 for
units and reporting information regarding the 24 BMEUs/staged DMUs, Table 2 for the
34 continuous DMUs, Table 3 for the 25 PVDS units, and Table 4 for the 16 BRM units.
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                                      Table 1: BMEUs/Staged DMUs

               Units Visited                   Report       Number of   Number of    Report      Postal
                                               Number        Controls      FTC        Date       Service
                                                            Observed    Exceptions               Quarter

1.     AFL Mailing Corp, Voorhees, NJ        FT-MA-13-010      11           0        2/14/2013      1
2.     Syracuse BMEU, Syracuse, NY
3.     RR Donnelley DMU, Hebron, OH          FT-MA-13-016      44           3        5/20/2013      2
4.     Ames BMEU, Ames, IA
5.     Presort Services Inc., Corona, CA
6.     Lansing BMEU, Lansing, MI
7.     Cincinnati BMEU, Cincinnati, OH
8.     Berwyn World Marketing Chicago
       DMU, McCook, IL
9.     Regulus Integrated Solutions LLC.,
       Napa, CA
10.    Tipton CDS DMU, Tipton, Iowa
11.    Pitney Bowes DMU, Milwaukee, WI
12.    IRS DMU, Detroit, MI                  FT-MA-13-018      24           2        8/27/2013      3
13.    Stevens Point, BMEU, Stevens Point,
       WI
14.    Fairrington Transport DMU,
       Bolingbrook, IL
15.    Washington, BMEU, Washington, D.C.
16.    Tinley Park BMEU, Tinley Park, IL
17.    Los Angeles BMEU, Los Angeles, CA
18.    J.A.F. BMEU, New York, NY
19.    San Antonio Permit, San Antonio, TX
20.    Trenton BMEU, Trenton, NJ             FT-MA-14-002      18           0        11/8/2013      4
21.    Columbus BMEU, Columbus, OH
22.    Portland BMEU, Scarborough, ME
23.    ICS Corporation, Philadelphia, PA
24.    News Printing Company, Claysburg,
       PA
Source: OIG
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                                                      Table 2: Continuous DMUs

                    Units Visited                      Report Number    Number    Number of     Report       Postal
                                                                          of         FTC         Date        Service
                                                                       Controls   Exceptions                 Quarter
                                                                       Observed
1.    Pitney-Bowes Presort Service, Grand Prairie,      FT-MA-13-011      12          0        2/14/2013        1
      TX
2.    Alaniz Metro Group, Mount Pleasant, IA
3.    Pewaukee Lomira Quad Graphics, Lomira, WI
4.    RR Donnelley, De Pere, WI                         FT-MA-13-015      28          1        5/20/2013        2
5.    Pewaukee Lomira Quad Graphics, Lomira, WI
6.    Pitney Bowes Presort Services, Grand Prairie,
      TX
7.    First Data Resources, Omaha, NE
8.    RR Donnelley, Logan, UT
9.    RR Donnelley, Lancaster, PA
10.   Arandell Corp, Menomonee Falls, WI                FT-MA-13-021      25          1        8/30/2013        3
11.   RR Donnelley Greenfield DMU, Lancaster, PA
12.   Quad Graphics, Chalfont, PA
13.   Quad Graphics, Martinsburg, WV
14.   RR Donnelley, Warsaw, IN
15.   Bell South, Alpharetta, GA
16.   Instant Web Company Direct DMU, Little
      Falls, MN
17.   RR Donnelley, Glasgow, KY
18.   RR Donnelley, Baraboo, WI
19.   Des Moines Presort Inc., Urbandale, IA
20.   Pewaukee Hartford Quad Graphics DMU,
      Hartford, WI
21.   CSG International, Omaha, NE                      FT-MA-14-004      34          6        11/19/2013       4
22.   RR Donnelley Greenfield DMU, Lancaster, PA
23.   First Data Resources, Omaha, NE
24.   Pewaukee Hartford Quad Graphics DMU,
      Hartford, WI
25.   CSG International, Inc., Crawfordville, FL
26.   Polaris Direct, LLC., Hooksett, NH
27.   Brown Printing Company,
      East Greenville, PA
28.   Instant Web Company Direct, Reading, PA
29.   North American Mailing Services, Inc., El
      Paso, TX
30.   AT&T Services, Inc., Houston, TX
31.   DST Output, El Dorado Hills, CA
32.   The Flyer, Tampa, FL
33.   Pre-Sort, Inc, Bensalem, PA
34.   RR Donnelley, Spartanburg, GA
Source: OIG
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                                               Table 3: PVDS

                Units Visited                   Report       Number of   Number of     Report     Postal
                                                Number        Controls      FTC         Date      Service
                                                             Observed    Exceptions               Quarter
1.    Pensacola Processing and Distribution   FT-MA-13-008       5           1        2/12/2013      1
      Center (P&DC), Pensacola, FL
2.    Baton Rouge P&DC, Baton Rouge, LA
3.    McAllen P&DC, McAllen, TX
4.    Sacramento P&DC, Sacramento, CA
5.    Johnstown P&DC, Johnstown, PA
6.    Southern Maine P&DC,                    FT-MA-13-013      4            0        3/3/2013      2
      Scarborough, ME
7.    Santa Clarita P&DC, Santa Clarita, CA
8.    Tampa Logistics and Distribution
      Center (L&DC), Tampa, FL
9.    Chattanooga P&DC, Chattanooga, TN
10.   Washington Network Distribution         FT-MA-13-020      11           1        8/30/2013     3
      Center (NDC), Capitol Heights, MD
11.   Des Moines NDC, Urbandale, IA
12.   Springfield L&DC, Springfield, MA
13.   Roanoke P&DC Center, Roanoke, VA
14.   Washington P&DC, Washington, DC
15.   Miami P&DC, Miami, FL
16.   Chicago Metro Surface Hub,
      Elk Grove Village, IL
17.   Western Nassau P&DC, Garden City,
      NY
18.   Colorado Springs P&DC,
      Colorado Springs, CO
19.   Lansing P&DC, Lansing, MI
20.   Los Angeles P&DC, Los Angeles, CA
21.   Harrisburg P&DC, Harrisburg, PA         FT-MA-14-003      5            0        11/8/2013     4
22.   Detroit P&DC, Detroit, MI
23.   Las Vegas P&DC, Las Vegas, NV
24.   North Metro P&DC, Duluth, GA
25.   San Francisco P&DC, San Francisco,
      CA
Source: OIG




                                                       6
     Fiscal Year 2013 Financial Testing Compliance                                             FT-MA-14-005
      Oversight Reviews



                                                     Table 4: BRM

                   Units Visited                   Report Number   Number of   Number of     Report      Postal
                                                                    Controls      FTC         Date      Service
                                                                                                                3
                                                                   Observed    Exceptions               Quarter
1.   Bush Terminal Station, Brooklyn, NY            FT-MA-13-019       8           1        8/30/2013      3
2.   Atlanta Main Post Office, Atlanta, GA
3.   Falmouth Branch, Fredericksburg, VA
4.   Big Sandy Post Office, Big Sandy, TX
5.   Coral Springs Branch Office,
     Coral Springs, FL
6.   San Antonio General Mail Facility,
     San Antonio, TX
7.   Hagerstown Post Office,
     Hagerstown, MD
8.   Bensalem Post Office, Bensalem, PA
9. Neenah Main Office, Neenah, WI                   FT-MA-14-001      8            0        11/8/2013      4
10. Washington Main Office,
    Washington, DC
11. Oak Brook Main Office, Oak Brook, IL
12. Tucson Main Office, Tucson, AZ
13. Church Street Post Office, New York, NY
14. Waukesha Main Office, Waukesha, WI
15. Oakland Park Post Office, Columbus, OH
16. Morton Grove Post Office,
    Morton Grove, IL
Source: OIG

     We conducted these reviews from October 2012 through January 2014 in accordance
     with the Council of the Inspectors General on Integrity and Efficiency, Quality Standards
     for Inspection and Evaluation. We provided a draft copy of this report to management
     on December 19, 2013, and, because we did not make any recommendations,
     management chose not to respond formally.

     We did not use computer-generated data to conduct the oversight reviews; therefore,
     we did not assess the reliability of computer-generated data. For these reviews, we
     examined drop shipment forms completed by mailers or mailers’ agents after the forms
     were signed and dated by Postal Service employees at DMUs and BMEUs, observed
     FTC analysts use PostalOne! reports during testing, and verified the reliability of
     PostalOne! by comparing report data to the postage payments source documentation
     and to the BRM invoice. We determined that the data were sufficiently reliable for the
     purpose of this report.




     3
         BRM mail reviews were not conducted during Qs 1 and 2.
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 Prior Audit Coverage

                                                                                   Monetary
           Report Title                 Report Number Final Report Date             Impact
Fiscal Year 2012 Financial               FT-MA-13-006             2/6/2013           None
Testing Compliance Oversight
Business Mail Entry Unit/Staged
Detached Mail Unit Reviews
Report Results:
We found that FTC analysts did not properly test, document, and report their examination
of key SOX financial reporting controls for mail verification and acceptance at three of the
27 units observed. Specifically, analysts did not test postage statement completeness at
one unit and did not accurately document work performed at two units. There is an
increased risk of not identifying, correcting, or reporting internal control deficiencies when
analysts do not test key controls or accurately document work performed. We did not
make recommendations in this report. Management took corrective action by testing the
missed control and corrected documentation to accurately report work performed.

Fiscal Year 2012 Financial              FT-MA-13-007           2/4/2013              None
Testing Compliance Oversight
Continuous Detached Mail Unit
Reviews
Report Results:
We observed the FTC group test at 18 of 153 sampled units. We determined that FTC
analysts properly tested, documented, and reported their examination of key SOX
reporting controls related to mail verification and acceptance at all 18 units. We did not
identify any exceptions; therefore, we did not make any recommendations.

Fiscal Year 2012 Financial             FT-MA-13-005            1/30/2013            None
Testing Compliance Oversight
Plant Verified Drop Shipment
Reviews
Report Results:
We observed the FTC group test drop shipment acceptance and verification procedures
at 25 of 198 sampled units and determined the group properly tested, documented, and
reported its testing results. We did not identify any exceptions; therefore, we did not make
any recommendations.
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                                                           Final Report        Monetary
           Report Title              Report Number              Date            Impact
  Fiscal Year 2012 Financial           FT-MA-13-004          1/29/2013            None
  Testing Compliance Oversight
  Business Reply Mail Reviews
  Report Results:
  We observed FTC group testing at 17 of 145 sampled units. We found the FTC
  group did not always properly test, document, and report its examinations of BRM
  key SOX financial reporting controls. Specifically, we observed that FTC analysts
  did not always follow their written test program for selecting transactions to test at
  two of the 17 units we visited. The testing procedures had changed, but
  management had not updated the test program. We did not make
  recommendations in this report but provided our observations to management
  throughout the year. The Postal Service took corrective action by updating the test
  program on April 19, 2012.

  Fiscal Year 2011 Financial           FI-MA-12-003          1/20/2012           None
  Testing Compliance Oversight
  Reviews
  Report Results:
  The FTC group made significant improvements in its testing of key SOX financial
  reporting controls in FY 2011. However, opportunities existed to improve the quality
  of testing and documenting results. Specifically, the FTC group did not identify
  testing errors in four unit reviews, did not perform steps in accordance with its
  program in three unit reviews, and did not adequately document its work in two unit
  reviews. As a result, the OIG did not always agree with FTC unit results. We did not
  make any recommendations in the report but provided our observations to the IPA
  and management throughout the year.
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